b66aba41cf76d12a6b97b0b12eff30effe4d0099bbbdefa977a3342490e9e34d

General

Target

6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
Size

244KB
MD5

6725c4ae37bae58529e1c3341e0527f7
SHA1

a26b6cd757679cc779c5dfb6c164824e73c2010a
SHA256

b66aba41cf76d12a6b97b0b12eff30effe4d0099bbbdefa977a3342490e9e34d
SHA512

f4474bc3f6ce0fd3fa069d552addf030b0f453d35041ce6b3997b5aa3b6bd14c6a4396aa5080b758b00a0bf04271c6df3fccec72713ff6c500ef4e6fea36c7c3
SSDEEP

6144:NtKe6YiDdv3m3mgKHIl7bNIFlJRUI8SgRKgimM:NtKe6Zv23Yd1mIkYgil

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9055330B-8B9A-11D5-EBA1-F78EEEEEE983}	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9055330B-8B9A-11D5-EBA1-F78EEEEEE983}\StubPath = "msaug32.exe"	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msaug32.exe	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\concp32.exe	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\concp32.exe	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\vcl32.exe	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\vcl32.exe	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msaug32.exe	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	1100	WerFault.exe	83

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9055330B-8B9A-11D5-EBA1-F78EEEEEE983}	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9055330B-8B9A-11D5-EBA1-F78EEEEEE983}\InprocServer32	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9055330B-8B9A-11D5-EBA1-F78EEEEEE983}\sm = ebb5525fa3bcf9422c8ff945977d6af9	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9055330B-8B9A-11D5-EBA1-F78EEEEEE983}\ax = e93ac016595147e8ce64634911d4ae70	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1100	6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6725c4ae37bae58529e1c3341e0527f7_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 712
  2⤵
  - Program crash
  PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1100 -ip 1100
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\concp32.exe

Filesize
251KB

MD5
8012863f143da81dfe2d886dac503f79

SHA1
6c32d225bb1102e902f7dbe63a222f5d7a4bd761

SHA256
5a136f9dad4e739eb0a897bb4796283292c64540376ac3749eecb7a64d71884a

SHA512
22286689fd6727d53cf5d49f8852e544e384e91e8eb11f21886bc3ebc74f2672742fff937a29264ba152aa7b3c15d8d39bc5e8ef1ee32853a56d840f90a6b7da

Download Submit
memory/1100-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1100-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads